The ‘Digital Arrest’ Was Fake, But The Money Trail Was Real: ED’s ₹27,850-Crore Banking Network And The Advocate It Calls A ‘Lien-Fixer’

A woman in Goa was allegedly made to believe that she was under investigation by India’s law-enforcement authorities. People posing as officials of the Telecom Regulatory Authority of India (TRAI) and the Central Bureau of Investigation (CBI) allegedly subjected her and her husband to continuous video surveillance, displayed a forged Supreme Court order and threatened them with the consequences of a fabricated criminal investigation.

The fraudsters allegedly demanded money through accounts falsely described as “Secret Supervision Accounts”. Approximately ₹2.60 crore was transferred.

There was, of course, no such lawful procedure as a digital arrest. There is no legal provision in India under which a person can be arrested through a video call, forced to remain on a messaging application or required to transfer money into an account for purported verification by an investigating agency.

The Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, had already issued a specific advisory on 6 March 2025 warning that criminals were impersonating police authorities, the CBI, the Enforcement Directorate, the RBI and other government agencies. The advisory explicitly states that digital arrest has no basis under Indian law.

Yet, according to the Enforcement Directorate (ED), the Goa fraud was not merely an isolated exercise in impersonation and extortion. It opened the door to a much larger alleged financial infrastructure involving hundreds of bank accounts, corporate entities, cash deposits, foreign-exchange operations, alleged intermediaries and a nationwide network of cyber-fraud proceeds.

And now, the investigation has reached an even more disturbing allegation: someone allegedly helped the network regain access to bank accounts that law-enforcement agencies had already frozen.

The ED has identified that alleged intermediary as Rashesh Bharatkumar Upadhyay, also known as Rashesh Shah, a Mumbai-based advocate.

His arrest on 24 October 2026 is the seventh arrest in this investigation. The ED describes him as a key intermediary who allegedly arranged the release of approximately 100 bank accounts by routing cash bribes to suspected officials through angadiyas.

If the agency’s allegations are established in court, this would represent something far more troubling than an ordinary cyber-fraud operation. It would suggest that even after fraud complaints reached the authorities and bank accounts were frozen, alleged intermediaries could attempt to reopen the financial channels through which suspected proceeds were moving.

The question is no longer limited to who made the fraudulent calls. It is also about who allegedly helped the money continue moving after the system had been alerted.

1. From a ₹2.60-crore digital-arrest fraud to a nationwide financial network

The original incident involved a Goa-based woman who was allegedly targeted between 21 May and 2 June 2025.

According to the investigation, fraudsters impersonated TRAI and CBI officials, falsely informed the victim that she was connected to a criminal investigation, displayed a forged Supreme Court order and maintained continuous video surveillance to create an atmosphere of intimidation.

The victim was allegedly made to believe that she was facing serious legal consequences. The money was then transferred to bank accounts represented as special government supervision accounts.

The amount involved was approximately ₹2.60 crore.

The strategy was not particularly sophisticated in legal terms. It was intimidation dressed up as institutional authority. The fraudsters allegedly borrowed the names of government agencies, the credibility of the Supreme Court and the fear associated with criminal proceedings to extract money from an ordinary citizen.

The most disturbing aspect is that the fraudsters allegedly understood precisely which buttons to press: fear of arrest, fear of reputational damage, fear of prosecution and fear of being publicly associated with a criminal case.

The objective was not to establish any genuine criminal proceeding. It was to manufacture an entirely fictitious one and monetise the victim’s fear.

The ED subsequently traced the victim’s money through multiple banking channels and said that the trail exposed a much larger network.

2. The numbers are staggering—and the distinction between turnover and stolen money matters

The ED’s investigation has brought out figures that demand serious public scrutiny.

According to the agency’s detailed investigation findings, the interconnected network of commodity, trading, travel and foreign-exchange entities had undertaken banking transactions exceeding ₹27,850 crore and deposited approximately ₹2,904 crore in cash.

The investigation also identified more than 400 beneficiary accounts.

The relevant reported figures are:

One important distinction must not be lost in sensational headlines: ₹27,850 crore is the banking transaction volume attributed to the network of entities. It is not the same thing as ₹27,850 crore in proven victim losses or an adjudicated amount of proceeds of crime.

The ED’s reported aggregate loss figure across the 330 complaints is ₹417.49 crore. The final amount attributable to criminal activity, and the extent of recoverable proceeds of crime, must be established through investigation and judicial proceedings.

But even with that distinction, the figures are deeply troubling.

More than 400 beneficiary accounts. Over ₹2,900 crore in cash deposits. More than 61,000 cash-machine transactions. Over 160 FIRs. Complaints across 20 States and Union Territories.

This is not the description of a small, isolated fraud involving one telephone caller and one bank account. It is the scale of a financial ecosystem that investigators now need to dismantle, account by account and transaction by transaction.

And the obvious question is: how did such a network allegedly operate at this scale without its underlying financial movements triggering an effective and timely institutional response?

3. How the alleged financial machinery worked

The ED’s investigation describes an organised process through which money allegedly moved from victim accounts into a collection and conversion network.

The first stage involved the movement of the victim’s money through dormant or newly opened bank accounts. According to the agency, the money was then fragmented across more than 400 beneficiary accounts.

The second stage involved the movement of funds into an interconnected group of commodity, trading, travel and foreign-exchange companies.

The third stage allegedly involved converting banking credits into cash and subsequently into foreign currency.

The ED has stated that companies holding Reserve Bank of India licences as full-fledged money changers were used in the alleged conversion process.

The agency has also described a troubling corporate structure. Some companies were allegedly incorporated in the names of persons of modest financial means, including employees, drivers and people residing in single-room tenements. These individuals were reflected as directors, while the ED alleges that the actual control of the accounts and company affairs rested with others.

If established, this would expose a familiar but highly dangerous weakness in corporate and financial compliance: the use of nominal directors and persons with limited financial capacity to provide a formal corporate identity to operations allegedly controlled by other individuals.

A company may have a certificate of incorporation, a registered office, a bank account and a director on paper. None of those formalities, by themselves, establishes that the person appearing in the corporate records is the actual controller of the business.

The issue is not that every company in the commodity, travel or foreign-exchange sector should be suspected. That would be irresponsible. The issue is whether the specific entities identified by the ED were used to receive, fragment, convert and move funds derived from cyber fraud.

The 61,448 bulk note acceptance machine transactions involving approximately ₹584.70 crore make the cash trail particularly important. Investigators need to establish the locations, account holders, cash-deposit patterns, source accounts, recipients and the individuals who controlled access to the funds.

It is not enough to identify the bank accounts through which money passed. The real task is to identify the people who controlled the transactions and benefited from them.

4. The alleged ‘lien-fixer’: the most disturbing dimension of the investigation

The arrest of Rashesh Bharatkumar Upadhyay has added a new dimension to the investigation.

The ED’s press release dated 26 October 2026 describes him as a key node in the alleged network.

According to the agency, whenever bank accounts linked to the network were frozen by law-enforcement agencies following cyber-fraud complaints, Rashesh Bharatkumar Upadhyay allegedly arranged their release by paying cash bribes to suspected officials.

The alleged payments were routed through angadiyas.

The ED attributes several specific activities to him:

• Arranging the unfreezing of approximately 100 bank accounts for different agents.
• Fixing the amounts allegedly to be paid.
• Determining the collection points.
• Coordinating onward payments.
• Routing cash payments through intermediaries.
• Allegedly facilitating the release of accounts even after investigative agencies had taken action.

The ED’s press release further states that, according to his alleged admission, one instance involved a payment exceeding ₹60 lakh.

These are serious allegations. They are not yet findings of guilt by a court.

Nevertheless, the central allegation deserves to be examined with exceptional scrutiny.

A bank-account freeze is not a decorative administrative entry. When a bank account is frozen following a cyber-fraud complaint, the purpose is to prevent further movement or dissipation of potentially fraudulent funds while the matter is investigated.

If an account is subsequently released, the reasons, authorisations, communications, payment instructions and institutional responsibility must be traceable.

The ED’s case raises a disturbing possibility: that an alleged network of intermediaries could have treated the release of frozen accounts as a service to be brokered for cash.

If that allegation is proved, the issue would extend beyond money laundering. It would raise fundamental questions about the integrity of the process through which investigative agencies, banks and other institutions respond to suspicious accounts.

A fraudster stealing money is one problem. A person allegedly arranging to reopen accounts that authorities had already frozen is an entirely different institutional threat.

The latter, if established, can undermine the very mechanism designed to stop cybercrime.

5. Who allegedly received the bribes?

This is perhaps the most important unanswered question in the entire investigation.

The ED’s press release says that Rashesh Bharatkumar Upadhyay allegedly arranged cash bribes for certain suspected officials of the agencies concerned. It also says the payments were routed through angadiyas.

However, the public press release does not identify the officials who allegedly received the money.

It does not publicly identify the individual angadiyas, the precise collection locations, the agency departments involved, or the officials who allegedly authorised or facilitated the release of the bank accounts.

That is where the investigation must now go.

Who allegedly collected the money?

Who allegedly received it?

Were the payments made to persons associated with a particular police unit, cybercrime investigation team, bank, or other authority?

Were the frozen accounts released through formal orders, informal instructions, communications with banks or another mechanism?

Were the same officials repeatedly associated with multiple releases?

Did any intermediary maintain records, coded communications, transaction registers or digital conversations relating to these payments?

Did any official’s known financial position or cash activity materially change during the relevant period?

These are not speculative accusations against any particular public servant. They are the obvious investigative questions arising from the ED’s own allegations.

The agency itself has stated that it is investigating the identity of officials who allegedly received the bribes and the intermediaries involved.

That investigation must not remain an unfinished sentence in a press release.

A seventh arrest is not a completed investigation. The identity of the alleged recipients, the route of the cash and the circumstances in which frozen accounts were released are central to establishing the truth.

If officials were involved, they must be identified and investigated independently of their positions, seniority or institutional affiliations. If the allegations against any official are not supported by evidence, that must be established just as rigorously.

There must be no selective accountability.

6. What happened after the ED searches?

The ED press release makes further allegations about Rashesh Bharatkumar Upadhyay’s conduct after investigative searches.

According to the agency, he continued his dealings even after ED searches had taken place, including in relation to accounts frozen by the ED itself.

The agency further alleges that he deleted chats with co-accused persons and switched off all his known mobile numbers before attempting to leave Mumbai.

These allegations are potentially important for reconstructing the post-search timeline.

The investigators must examine the relevant devices, forensic extraction reports, available cloud backups, communication metadata, call-detail records, bank transaction logs and records held by the intermediaries.

The deletion of a message, by itself, does not establish that a crime was committed. Nor does switching off a phone prove guilt. The significance of these alleged actions depends on the surrounding evidence and the sequence of events.

But where an investigation concerns alleged payments, cash intermediaries, multiple bank accounts and a nationwide financial trail, digital communications may provide important corroboration.

The investigation should establish what was communicated, when it was communicated, who communicated it and whether those communications correspond with actual account releases and cash movements.

7. The airport interception: an arrest, not a conviction

The ED arrested Rashesh Bharatkumar Upadhyay on 24 October 2026.

According to its press release, he was intercepted at the boarding gate of Chhatrapati Shivaji Maharaj International Airport, Mumbai, while attempting to board an early-morning connecting flight to Delhi without a return booking.

The operation was carried out with the assistance of Mumbai Customs and the Central Industrial Security Force.

He was produced before the Special Court under the PMLA at North Goa, which remanded him to ED custody until 29 October 2026.

The agency characterised the circumstances as an attempted flight.

It is important, however, not to turn the fact of boarding a flight into proof of guilt or an independent finding of absconding. The significance of the travel arrangements, the alleged conduct following the searches and the reasons for the interception are matters for the investigating agency and the court to assess.

The public record available for this report confirms the initial ED custody remand. A subsequent publicly verifiable order establishing his custody, release or bail status after 29 October was not located in the material reviewed up to 3 November 2026. That position should be updated if a subsequent court order becomes available.

8. Advocate by profession, alleged intermediary by investigation: the question of professional privilege

One of the most consequential aspects of the press release concerns Rashesh Bharatkumar Upadhyay’s professional status.

The ED states that although he was enrolled as an advocate, he had never appeared in court or filed a vakalatnama for the co-accused persons or their companies.

The agency alleges that his professional standing was used as a cover for brokering bribes and facilitating the release of fraud-linked bank accounts.

This distinction matters.

The law protects genuine lawyer-client communications because people must be able to seek legal advice without fear that every confidential exchange will automatically become public. But professional privilege is not a licence to facilitate criminal activity.

Section 132 of the Bharatiya Sakshya Adhiniyam, 2023, which governs professional communications, protects qualifying communications made in the course and for the purpose of professional legal service. It also provides exceptions for communications made in furtherance of an illegal purpose and certain facts observed by an advocate showing that a crime or fraud has been committed.

The legal distinction is therefore between genuine professional legal advice and alleged participation in conduct that is outside the legitimate purpose of legal representation.

The precise applicability of the statutory exceptions in any particular case must be determined by the court on the evidence.

An advocate’s professional enrolment cannot automatically establish criminal involvement. Equally, a professional title cannot be treated as immunity from investigation where credible evidence indicates alleged participation in unlawful activity.

If the ED’s case is ultimately established, the conduct described would be a grave breach of the public trust associated with the legal profession.

The legal profession is not a commercial disguise for allegedly arranging bribes, nor is a law degree a credential that can legitimise the release of suspected fraud proceeds.

But the final determination must be based on evidence, not the headline of an arrest announcement.

9. The previous arrests: seven people, multiple alleged roles

Rashesh Bharatkumar Upadhyay is the seventh person arrested by the ED in this PMLA investigation.

The publicly reported arrest sequence is as follows:

The sequence shows that the investigation has moved through different alleged layers of the operation.

The first two arrests concerned individuals whom the ED described as controllers of the network. The second set involved a chartered accountant and two alleged agents. The sixth arrest concerned an individual whom the ED described as arranging bank credits through RTGS transactions. The seventh arrest concerns the alleged intermediary responsible for getting frozen accounts released.

This sequence is significant because the alleged network was not restricted to the people who made the fraudulent calls. Its financial infrastructure allegedly required banking channels, corporate entities, cash conversion, foreign-exchange operations and individuals who could arrange account access.

That is why the investigation must not stop with the arrest of persons who appear at the operational edges of the network. It must establish the identities of those who controlled and benefited from the entire arrangement.

The alleged controllers

Fahim Moin Hussain Sayed and Naim Mueen Sayyed were arrested by the ED on 23 August 2026.

The agency identified them as alleged controllers of the interconnected network of commodity, trading, travel and foreign-exchange entities.

The ED’s investigation claims that this network was connected to hundreds of victim complaints and more than 160 FIRs across 20 States and Union Territories.

Their arrest is an important development in the investigation, but the question of ultimate responsibility will depend on the evidence and the outcome of the proceedings.

The chartered accountant and alleged company infrastructure

Bhushan Suryakant Moye, a chartered accountant, was arrested on 27 August 2026.

The ED reportedly alleged that he incorporated approximately 21 companies for the Fahim Sayyed group and argued that these entities formed part of the alleged infrastructure for receiving, layering and concealing proceeds of crime.

However, an important judicial development followed.

On 22 October 2026, the Goa High Court granted Moye regular bail. According to the published report of the proceedings, the High Court observed that merely providing legitimate professional services for company incorporation cannot automatically make a professional liable for the subsequent use of a client’s corporate bank accounts.

The reported account of the order also states that the High Court found no material on record demonstrating that Moye was a beneficiary of the laundering activity, had assisted in laundering proceeds of crime, or had played a discernible role in their concealment, possession or acquisition.

Moye was released on a personal bond of ₹50,000 with local sureties.

This development deserves attention. Bail is not acquittal, and it does not terminate the investigation. But it is an important reminder that professional services must not be confused with knowing participation in a criminal enterprise.

The ED must establish the necessary connection between a professional’s work and the alleged proceeds of crime. Simply incorporating a company cannot, by itself, establish money laundering.

The alleged RTGS intermediary

Mukesh Kumar Pukhraj Jain alias Mukesh Bhai was arrested on 16 October 2026.

The ED described him as an RTGS agent who allegedly arranged banking credits into the network’s accounts through brokers and received cash from the persons controlling the network, retaining a commission.

The agency further claimed that, in statements recorded during the PMLA investigation, Jain admitted knowing that the money in the chain originated from cyber fraud, including digital-arrest fraud.

The ED also alleged that he destroyed records and mobile handsets containing evidence of the business after its searches and gave evasive replies during the investigation.

These assertions are allegations attributed to the ED. Their evidentiary value, context and legal consequences must be determined through the proceedings.

The arrest is nevertheless important because it points to the alleged role of banking intermediaries in the movement of funds between the accounts of the network and its controllers.

10. The earlier Goa police arrest: the original fraud trail

The Goa police investigation had also resulted in an earlier arrest in June 2025.

According to reporting by The Goan, the Cyber Crime Police arrested Rijas K, a resident of Kozhikode, Kerala, in connection with the underlying fraud.

The police stated that approximately ₹76.35 lakh from the amount transferred by the Goa victim had been traced to an ICICI Bank account held by Rijas K.

The police also alleged that he was connected to at least 11 other cybercrime cases across the country, with an estimated fraud amount of approximately ₹22.77 crore.

It is important to distinguish this arrest from the ED’s seven arrests under the present PMLA investigation. Rijas K’s arrest was made by Goa police in the underlying cybercrime investigation; it is not included in the ED’s seven-person arrest count.

The police-reported figure of ₹22.77 crore is an investigative estimate attributed to the police, not a judicially established amount or a conviction.

Nevertheless, the earlier arrest demonstrates that the original Goa fraud case had already produced a police investigation into the destination of the victim’s money before the ED’s wider money-laundering investigation developed.

The agency must now publicly establish, through appropriate proceedings, how the individual account trail connects with the wider network and which people controlled each stage of the movement of funds.

11. The disturbing scale of digital-arrest fraud across India

The Goa case is part of a much broader national problem.

Figures from the Indian Cybercrime Coordination Centre placed before the Supreme Court show the scale of the reported digital-arrest threat.

The 2026 data covers only the first eight months, so it should not be compared with a full-year figure as though the periods were identical.

The numbers demonstrate that even after the decline in recorded complaints from the 2024 peak, the financial damage remains substantial.

During the Supreme Court proceedings in October 2026, the Court also referred to approximately ₹800 crore in losses during 2026 up to the relevant hearing. That figure relates to a later reporting point and should not be confused with the January–August figure of over ₹647 crore.

The figures are not merely statistics. They represent citizens who were frightened into transferring life savings, retirement funds, business capital and accumulated wealth to criminal networks.

The alarming question is why a fraud technique that has been repeatedly publicised, officially warned against and discussed in court continues to extract such enormous sums from citizens.

Awareness campaigns are necessary. But awareness campaigns alone cannot compensate for weak bank-account monitoring, insufficient KYC controls, delayed inter-agency coordination and the slow recovery of stolen funds.

12. The Supreme Court has now raised the question of bank accountability

The investigation also comes at a time when the Supreme Court is examining the institutional response to digital-arrest frauds.

On 29 October 2026, the Supreme Court pressed for stronger and enforceable safeguards from the Reserve Bank of India and financial institutions.

The Court discussed the need for banks to identify unusual transactions, temporarily suspend suspicious transfers, undertake verification and ensure that suspicious activity is reported promptly.

It also emphasised that financial institutions should be held financially accountable where a fraud is found to have resulted from their failure to exercise due diligence.

The Court called for the proposed RBI framework to contain meaningful liability provisions rather than merely general guidelines.

The RBI’s proposed Know Your Customer Amendment Directions, 2026, were expected to be notified by 30 November and operationalised by 31 December, subject to the ongoing process and the Court’s consideration.

These were prospective regulatory developments at the time of the hearing, not a statement that a complete compensation regime was already in force.

The Supreme Court’s intervention exposes a larger weakness in the country’s digital-fraud response: institutions cannot remain reactive when suspicious financial movements can be identified before the money disappears.

In the present Goa investigation, the ED says accounts were frozen and then allegedly released through bribes. That allegation makes the question of institutional accountability even more urgent.

The authorities must establish whether proper safeguards existed at the time accounts were opened, whether suspicious transactions were flagged, whether freezes were promptly communicated to banks, and how subsequent releases were authorised.

It is not enough to investigate only the account holders and the intermediaries. The financial institutions and the official processes through which these transactions passed must also be examined wherever evidence warrants it.

13. The biggest unanswered question: who controlled the accounts after they were frozen?

The ED’s allegation that approximately 100 bank accounts were allegedly unfrozen through Rashesh Bharatkumar Upadhyay’s arrangements deserves a transaction-by-transaction investigation.

For every account, investigators should establish:

1. Which agency or authority originally froze it?
2. What was the date, reason and legal basis of the freeze?
3. Which bank or financial institution held the account?
4. Who requested or facilitated its release?
5. What formal order or instruction was relied upon?
6. Which intermediary allegedly communicated with the relevant official?
7. Was any cash payment made, and what evidence supports that allegation?
8. Who allegedly collected and received the money?
9. What transactions took place after the account became operational again?
10. Where did the funds eventually go?

This is the difference between announcing an arrest and dismantling a network.

A complete investigation must reconstruct the exact sequence of every relevant freeze and unfreezing event.

If the same intermediary appears in multiple cases, that connection must be mapped. If the same official appears in multiple release decisions, that pattern must be examined. If the same cash courier or angadiya is associated with different accounts, those connections must be identified.

The investigation should also examine whether the allegedly released accounts were used again to receive or transfer suspected fraud proceeds.

Without this account-level reconstruction, the public may learn the names of seven arrested persons without ever learning how the alleged system actually worked.

14. What the ED and other agencies must do now

The agencies have already carried out arrests and searches. The difficult part begins now.

The ED should identify and investigate the suspected recipients of the alleged bribes. The agency should pursue the angadiyas and other intermediaries, reconstruct the cash trail and establish whether the alleged payments correspond with specific account releases.

The following steps are essential:

First, identify the alleged public-servant recipients. The investigation must establish whether any official accepted illegal gratification, the precise amount involved and the alleged circumstances of each payment. Any official against whom credible evidence emerges must face an independent investigation and appropriate legal action.

Second, complete the account-level reconstruction. All identified beneficiary accounts must be reconciled with the 330 victim complaints and 163 FIRs. The 101 complaints involving the movement of one victim’s money into two or more network entities deserve particular attention.

Third, investigate the corporate structure. The actual beneficial owners, bank-account operators, directors, authorised signatories and individuals exercising control over the relevant companies must be identified. Nominal directors should not become substitutes for the real investigation into who controlled the businesses.

Fourth, examine foreign-exchange transactions. The ED and other competent regulators should examine the role of the relevant licensed money changers, transaction records, customer due diligence, cash-conversion documentation and the onward movement of funds. This should be done on an entity-specific evidentiary basis, not through blanket allegations against an entire industry.

Fifth, preserve and examine digital evidence. Mobile devices, deleted messages, call records, cloud backups, email communications, bank records, transaction logs and available CCTV footage should be preserved and forensically analysed. The chain of custody and integrity of electronic evidence must be maintained.

Sixth, investigate banking compliance failures. Investigators and banking regulators should examine how dormant and newly opened accounts received substantial inflows, why unusual transactions may not have triggered timely intervention, and whether any account freezes were lifted without proper verification.

Seventh, trace and recover the proceeds of crime. The focus must not remain on arresting intermediaries. Assets, cash, account balances, properties and other traceable proceeds should be identified and dealt with under the applicable law. The priority should also be to restore recoverable funds to victims through lawful procedures.

Eighth, coordinate across States. With complaints and FIRs spanning 20 States and Union Territories, investigation cannot be fragmented into disconnected files. State police forces, cybercrime units, banks, regulators and the ED must share relevant evidence through coordinated mechanisms.

Ninth, ensure speedy prosecution and trial. Where sufficient admissible evidence exists, prosecution complaints and chargesheets should be filed without avoidable delay. Courts should be provided with properly organised evidence and a clear account-wise financial trail. Speed should mean disciplined investigation and efficient case management, not compromising due process.

Tenth, make victim recovery measurable. The public should know how much money has been frozen, attached, recovered and actually returned to victims. These are different categories and must not be merged into one headline figure.

The public does not need another press release promising that further investigation is underway. It needs the investigation to reach the people who controlled the money, the people who allegedly collected the bribes and the people who ultimately benefited.

15. Seven arrests are not the same as dismantling the network

The ED deserves credit for pursuing a financial investigation that has moved beyond the original victim complaint and identified a much wider alleged network.

But enforcement agencies must also be judged by what happens after the arrests.

How many of the 400-plus accounts have been completely investigated? How much of the alleged proceeds of crime have been traced? How much has been recovered? How many victims have received their money back? Have the suspected official recipients been identified? Have the alleged cash intermediaries been questioned and their records examined? Have all the linked entities been mapped?

These are not unreasonable questions. They are the minimum questions a public investigation of this scale should be able to answer.

A network does not collapse simply because its alleged intermediaries are arrested. It collapses when its financial channels are identified, its controllers are prosecuted, its assets are traced and its ability to move money is permanently disrupted.

The most disturbing allegation in this case is that accounts already frozen by law-enforcement agencies were allegedly brought back into operation through cash payments.

That is the allegation the investigation must either establish with evidence or disprove through a transparent legal process.

If established, it would expose a serious failure of the very mechanisms intended to protect victims and prevent the movement of suspected criminal proceeds.

An arrest at an airport may make a headline. A complete, evidence-based investigation into the alleged recipients of bribes, the account-release process, the cash trail and the ultimate beneficiaries would make a difference.

The victims need more than the spectacle of another arrest. They need their money traced, the people responsible prosecuted and the institutions that failed examined.

The system must now demonstrate that a frozen account cannot be turned back into an operational financial channel simply because someone allegedly knows whom to approach and how much cash to arrange.

The fake digital arrest was designed to make citizens believe that the law was closing in on them. The investigation must now establish whether anyone within the system allegedly helped the criminals keep the money moving.

EDITORIAL CONCLUSION: INVESTIGATE THE ENTIRE CHAIN, NOT JUST THE PEOPLE AT ITS EDGES

The Goa digital-arrest case has exposed a deeply troubling set of allegations involving impersonation of government authorities, forged judicial documents, mule accounts, corporate entities, cash deposits, foreign-exchange operations and alleged bribery to release frozen bank accounts.

The arrest of Rashesh Bharatkumar Upadhyay must therefore be treated as one important stage of a much larger investigation, not as its conclusion.

The authorities must move faster, but they must also move carefully. The alleged recipients of bribes must be identified. The financial trail must be reconstructed. The role of banks and intermediaries must be examined. Victims must receive measurable recovery efforts. And the trial must proceed without avoidable delay while preserving the rights of every accused person.

There should be no special protection for a person because of professional status, influence, financial resources or institutional connections. Equally, there should be no presumption of guilt merely because a person has been arrested.

The only acceptable conclusion is one reached through credible evidence, a fair investigation and a competent court.

The public is entitled to demand an investigation that does not stop at the easiest arrests, but reaches every person whose involvement is supported by evidence.